1
$\begingroup$

I've been reading up on the relationship between private keys and public keys (as well as hashing), and I watched a few videos, but I am still a bit confused.

I don't have a programming background, and I want to be able to explain these things to an "everyday person".

What I found is that before a message is "encrypted" with a "public key" that key FIRST must be shared with the receiver.

How is the public key being shared?

Thanks for your help.

$\endgroup$

migrated from english.stackexchange.com Jul 19 at 13:37

This question came from our site for linguists, etymologists, and serious English language enthusiasts.

  • $\begingroup$ This isn't an English question, but the public key can be shared in any way you wish. It does not need to be kept secret because it is used only for encoding, which is why it has to be shared "first", but with the transmitter. The receiver already knows it and gives it to the transmitter, to encode the message. For decoding, the private key is used and must not be shared. $\endgroup$ – Weather Vane Jul 19 at 13:12
  • 3
    $\begingroup$ A discussion of Public-key cryptography can be found here. $\endgroup$ – Weather Vane Jul 19 at 13:22
  • $\begingroup$ Thanks so much, I didn't know that this forum is structured in such a way. $\endgroup$ – arthurzee Jul 19 at 13:55
  • 1
    $\begingroup$ Usually the key is shared by just distributing it (e.g. as e-mail attachment, via keyservers or in the situation where it's needed). The really interesting question is how it is shared such that the recipient knows that the key belongs to the claimed entity. $\endgroup$ – SEJPM Jul 19 at 14:34
  • $\begingroup$ ah, for sure it is. Lets see what else we can get. $\endgroup$ – arthurzee Jul 19 at 15:04
2
$\begingroup$

The key is shared via email, via scp/rsync/ssh-copy-id (remote copy), or by editing the settings of your account on a website. If you look in a web application that supports PKI, there will be an option under settings where you can upload your public key. Running an agent on your trusted OS machine (which has your private key) allows automatic verification via custom client software. It will understand you have an agent, then verify your local private key against the server's known public key.

The metaphor used is that of an empty box. You give a friend a padlock, but you keep the key. They put valuables in the box, and close the padlock you gave them on the box. Now only you can open the box and get the valuables. The public key is the padlock. The private key is the key. Imagine that anyone can have the same padlock all over the world, but only you can open whatever they send you.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.